[SandObserver]

Summary

• Add scripts/node-security.js, which fails when nodejs.org/dist/index.json lists a newer security release on the installed Node.js major line. An unreadable version or index also fails.
• Add a step to the weekly published image scan that reads NODE_VERSION from the image and runs the script. It runs even when the Trivy step fails.
• Trivy does not report the Node.js runtime in the image, so a Node security release never failed this scan.

Testing
All green. Added 6 tests for the version comparison.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.